v1.13 Backports 2023-09-04 #27925

jibi · 2023-09-04T14:22:49Z

PRs skipped due to conflicts:

Fix propagation of namespace labels to CEP labels #27831 (@tklauser)
- skipped as v1.13 has not been switched to resource[T] for CEP
ci-e2e: Add secondary network NodePort tests #27738 (@brb)
- skipped while we figure out what to do with the related cilium CLI changes
bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798 (@ti-mo)
- dropped while bpf: lxc: defer CT_INGRESS entry creation for loopback connections #27602 gets backported, as bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798 depends on that

Once this PR is merged, you can update the PR labels via:

for pr in 27656 27572 27171 27818 27416 27814 27359 27706 27170 27911; do contrib/backporting/set-labels.py $pr done 1.13; done

or with

make add-labels BRANCH=v1.13 ISSUES=27656,27572,27171,27818,27416,27814,27359,27706,27170,27911

[ upstream commit 03ac4b1 ] This refactoring moves the actual logic to extract the maximum sequence number into a dedicated function. That will be useful to allow us to test this logic in a following commit. This commit has no functionnal changes. As a reminder, we can't use netlink.XfrmStatesList here because it doesn't have the sequence numbers. We can't use JSON format because the ip xfrm commands don't support it. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 165db3a ] maxSequenceNumber currently iterates over all XFRM states in the ip xfrm state list output to find the largest sequence number. It however does so while keeping the parsed sequence numbers as hexadecimal strings. Hence, a number like "0xc1" is understood as being larger than e.g. "0x1234". This commit fixes it by parsing the sequence numbers into int64 before comparing them. We also need to adapt the regular expression slightly to avoid considering the "0x" prefix as part of the number, given strconv.ParseInt doesn't support it. Fixes: 2842c49 ("cli: add helper functions for `cilium encrypt`") Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 21d7d0a ] This commit simply adds two small unit tests for the extractMaxSequenceNumber function. The first test covers the bug fixed in the previous commit. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit b46867c ] The sorting function for DNSZombies was subtly broken, and didn't do what it advertised. Write some tests to confirm the suspicion and fix the function. Reported-by: Jussi Maki <joamaki@isovalent.com> Signed-off-by: David Bimmler <david.bimmler@isovalent.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit ca5de0f ] A user pointed out that what we call "Labels-based" policies are actually matching the labels on Endpoints, but also explicitly *not* matching labels on Services. To make this more clear, change the name in the docs to Endpoints based policies. Co-authored-by: Nathan Sweet <nathanjsweet@users.noreply.github.com> Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 38b4a32 ] A user pointed out that the position of this callout made it seem like the callout only applies to the first example rather than applying to all Services based policies. Move the callout to the top of the section to make the relationship clearer. Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 953e83e ] Currently, defining an `Ingress` without an `HTTPIngressRule` (e.g. only Host set) results in a panic in the Cilium Operator. Therefore, this commit changes the ingress ingestion to process the HTTP paths only if the HTTPIngressRule is set on the rule. Backporting conflicts: * minor conflict in operator/pkg/model/ingestion/ingress_test.go Signed-off-by: Marco Hofstetter <marco.hofstetter@isovalent.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

jibi · 2023-09-04T14:25:09Z

/test-backport-1.13

brb · 2023-09-04T14:48:32Z

cilium-agent is failing in ci-e2e:

2023-09-04T14:33:42.564306864Z level=fatal msg="failed to start: daemon creation failed: failed to finalise LB initialization: Cannot retrieve eth1 link: Link not found" subsys=daemon

It's because https://github.com/cilium/cilium/blob/v1.13/contrib/scripts/kind.sh#L37 doesn't have secondary-network option which was introduced by #26338. Let's backport that PR to v1.13.

Another thing is that CLI is at v0.15.3 :-(, but that should not cause any problems.

jibi · 2023-09-04T15:41:34Z

cilium-agent is failing in ci-e2e:

2023-09-04T14:33:42.564306864Z level=fatal msg="failed to start: daemon creation failed: failed to finalise LB initialization: Cannot retrieve eth1 link: Link not found" subsys=daemon

It's because https://github.com/cilium/cilium/blob/v1.13/contrib/scripts/kind.sh#L37 doesn't have secondary-network option which was introduced by #26338. Let's backport that PR to v1.13.

👍

Another thing is that CLI is at v0.15.3 :-(

should I tick renovate to bump v1.13 as well?

brb · 2023-09-04T15:46:18Z

should I tick renovate to bump v1.13 as well?

Yes, please.

jibi · 2023-09-05T08:52:41Z

should I tick renovate to bump v1.13 as well?

Yes, please.

synced offline, dropped #27738 while we understand how to sort the cilium CLI situation

jibi · 2023-09-05T08:52:55Z

/test-backport-1.13

tklauser

My change looks good, thanks.

Fix propagation of namespace labels to CEP labels #27831 (@tklauser)

skipped as v1.13 has not been switched to resource[T] for CEP

~~Will backport myself to v1.13 and v1.12.~~ Not applicable, will remove corresponding backport labels.

bimmlerd

#27572 LGTM, thanks!

qmonnet

bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27798

Looks good and I tested the same commit locally to make sure it addresses the bug on 1.13 as well. Thanks for dealing with the conflict!

pchaigno

My PR looks good. Thanks!

brb

Thanks!

joestringer

🚢

.github/actions/cilium-config/action.yml

qmonnet

Apologies, I just realised, regarding #27798: it depends on #27602, which was not marked for backports on 1.13 (I labelled it now). Is it possible to add it to this PR, please?

[ upstream commit 7e64fb6 ] * Expose devices (to support multi-network tests). * Set cluster name. Required by older versions of Cilium CLI when doing upgrades. * Add misc option to set bpfClockProbe (#26955) and cni.uninstall (for upgrade tests it can result in pods being restarted). Backporting conflicts: * minor conflict in .github/actions/cilium-config/action.yml due to L7 config not being defined in main * removed mutual-auth setting as v1.13 doesn't support that Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 7fbfd5d ] The demo.proto download directory has been renamed from 'pb' to 'protos' by the commit [1]. Also, update the microservices-demo brance name to 'main'. [1] GoogleCloudPlatform/microservices-demo@76571f5 Signed-off-by: Haiyue Wang <haiyue.wang@intel.com> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 141ac8b ] Cosmetic changes. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit e4c4a5c ] Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit c667c54 ] Small optimization. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 836598a ] * cni.uninstall - to avoid pods from being rescheduled during the upgrade. * bpfClockProbe - #26955. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit bf25136 ] Currently, some workflows use a timeout of 10 minutes when waiting for images to be built and become available on quay. However, when there are lots of open PRs and thus image builds, this timeout is occasionally hit in CI. Thus, consistently bump the timeout to 30 minutes which is already used in some workflows. Backporting conflicts: * minor conflict in conformance-e2e, and tests-l4lb has been updated as well Signed-off-by: Tobias Klauser <tobias@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit c103882 ] This just makes it easier for editing. No changes. Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit a568868 ] Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

[ upstream commit 0da3f7e ] Currently, the feature is not used, and its test is blocking the LVH upgrade [1][2]. Let's remove the test case. Once it is in use, we should rethink the testing approach (either implement as a BPF unit test, or an advanced CLI connectivity test). [1]: #27599 [2]: #27688 Backporting conflicts: * .github/actions/ginkgo/main-focus.yaml doesn't exist in v1.13 Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

jibi · 2023-09-07T06:46:51Z

Apologies, I just realised, regarding #27798: it depends on #27602, which was not marked for backports on 1.13 (I labelled it now). Is it possible to add it to this PR, please?

@qmonnet there are a few conflicts and I see @julianwiedmann is already taking care of the v1.14 backport, so I'll let him handle also v1.13 (and drop #27798 for now)

jibi · 2023-09-07T06:50:09Z

/test-backport-1.13

Job 'Cilium-PR-K8s-1.24-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks E/W loadbalancing (ClusterIP, NodePort from inside cluster, etc) Tests NodePort inside cluster (kube-proxy) with IPSec and externalTrafficPolicy=Local

Failure Output

FAIL: Request from k8s1 to service http://[fd04::11]:30903 failed

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.24-kernel-4.19/143/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.24-kernel-4.19 so I can create one.

Then please upload the Jenkins artifacts to that issue.

jibi · 2023-09-07T09:34:23Z

/test-1.24-4.19

pchaigno and others added 7 commits September 4, 2023 13:35

jibi added kind/backports This PR provides functionality previously merged into master. backport/1.13 This PR represents a backport for Cilium 1.13.x of a PR that was merged to main. labels Sep 4, 2023

jibi requested review from tklauser, ti-mo, pchaigno, bimmlerd, joestringer, mhofstetter and brb September 4, 2023 14:22

mhofstetter approved these changes Sep 4, 2023

View reviewed changes

jibi force-pushed the pr/v1.13-backport-2023-09-04 branch from a76372a to 0531bdf Compare September 5, 2023 08:51

tklauser approved these changes Sep 5, 2023

View reviewed changes

bimmlerd approved these changes Sep 5, 2023

View reviewed changes

qmonnet approved these changes Sep 5, 2023

View reviewed changes

qmonnet removed the request for review from ti-mo September 5, 2023 10:44

jibi marked this pull request as ready for review September 5, 2023 14:24

jibi requested a review from a team as a code owner September 5, 2023 14:25

jibi requested review from a team as code owners September 5, 2023 14:25

pchaigno approved these changes Sep 5, 2023

View reviewed changes

brb approved these changes Sep 6, 2023

View reviewed changes

qmonnet mentioned this pull request Sep 6, 2023

IPv4 Service hairpin return-traffic denied by ingress policy #27709

Closed

2 tasks

joestringer approved these changes Sep 6, 2023

View reviewed changes

joestringer reviewed Sep 6, 2023

View reviewed changes

.github/actions/cilium-config/action.yml Outdated Show resolved Hide resolved

qmonnet requested changes Sep 6, 2023

View reviewed changes

brb and others added 10 commits September 7, 2023 08:34

gh/worklows: Delete noop in ci-ipsec-upgrade

172e60a

[ upstream commit 141ac8b ] Cosmetic changes. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

gh/workflows: Use cilium-config action in ci-ipsec-upgrade

0029256

[ upstream commit e4c4a5c ] Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

gh/workflows: Create K8s before waiting for img in ci-ipsec-upgrade

576545a

[ upstream commit c667c54 ] Small optimization. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

ci-ipsec-upgrade: Disable some settings

a54317e

[ upstream commit 836598a ] * cni.uninstall - to avoid pods from being rescheduled during the upgrade. * bpfClockProbe - #26955. Signed-off-by: Martynas Pumputis <m@lambda.lt> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

docs: Word-wrap firewall section

8abc79c

[ upstream commit c103882 ] This just makes it easier for editing. No changes. Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

docs: Add WireGuard into the firewall rules

d314516

[ upstream commit a568868 ] Signed-off-by: Joe Stringer <joe@cilium.io> Signed-off-by: Gilberto Bertin <jibi@cilium.io>

jibi requested a review from qmonnet September 7, 2023 06:48

jibi force-pushed the pr/v1.13-backport-2023-09-04 branch from 0531bdf to 9941790 Compare September 7, 2023 06:48

qmonnet mentioned this pull request Sep 7, 2023

[v1.12] bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes #27980

Merged

4 tasks

qmonnet approved these changes Sep 7, 2023

View reviewed changes

youngnick approved these changes Sep 7, 2023

View reviewed changes

maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Sep 7, 2023

jibi merged commit 0603314 into v1.13 Sep 7, 2023
120 checks passed

jibi deleted the pr/v1.13-backport-2023-09-04 branch September 7, 2023 13:23

michi-covalent mentioned this pull request Sep 9, 2023

Prepare for release v1.13.7 #28053

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v1.13 Backports 2023-09-04 #27925

v1.13 Backports 2023-09-04 #27925

jibi commented Sep 4, 2023 •

edited by youngnick

jibi commented Sep 4, 2023

brb commented Sep 4, 2023 •

edited

jibi commented Sep 4, 2023

brb commented Sep 4, 2023

jibi commented Sep 5, 2023

jibi commented Sep 5, 2023

tklauser left a comment •

edited

bimmlerd left a comment

qmonnet left a comment

pchaigno left a comment

brb left a comment

joestringer left a comment

qmonnet left a comment •

edited

jibi commented Sep 7, 2023

jibi commented Sep 7, 2023 •

edited by maintainer-s-little-helper bot

Test Name

Failure Output

jibi commented Sep 7, 2023

v1.13 Backports 2023-09-04 #27925

v1.13 Backports 2023-09-04 #27925

Conversation

jibi commented Sep 4, 2023 • edited by youngnick

jibi commented Sep 4, 2023

brb commented Sep 4, 2023 • edited

jibi commented Sep 4, 2023

brb commented Sep 4, 2023

jibi commented Sep 5, 2023

jibi commented Sep 5, 2023

tklauser left a comment • edited

Choose a reason for hiding this comment

bimmlerd left a comment

Choose a reason for hiding this comment

qmonnet left a comment

Choose a reason for hiding this comment

pchaigno left a comment

Choose a reason for hiding this comment

brb left a comment

Choose a reason for hiding this comment

joestringer left a comment

Choose a reason for hiding this comment

qmonnet left a comment • edited

Choose a reason for hiding this comment

jibi commented Sep 7, 2023

jibi commented Sep 7, 2023 • edited by maintainer-s-little-helper bot

Test Name

Failure Output

jibi commented Sep 7, 2023

jibi commented Sep 4, 2023 •

edited by youngnick

brb commented Sep 4, 2023 •

edited

tklauser left a comment •

edited

qmonnet left a comment •

edited

jibi commented Sep 7, 2023 •

edited by maintainer-s-little-helper bot